Cortex XDR Policy - Executables blocked from removable media

[Abdullah-Tariq]

Hi,

As the name suggests, we have a policy to block executables from removable storage. While it works great, there are issues arising when a user wants to install drivers for printers, scanners etc. Since as soon as a device is connected for the first time, it gets mounted as a storage drive. Is there a way to allow only such devices to be added to exceptions from this? 

Any help will be much appreciated.

Regards,

Abdullah

[susekar]

Hello @Abdullah-Tariq ,

Greetings  for the day.

Yes, there is a way to allow these specific printer and scanner drivers while maintaining your policy to block other executables from removable storage. This is typically achieved by creating a Legacy Agent Exception specifically for the Removable Media Files module.

Root Cause:

Many multi-function printers and scanners mount a virtual CD-ROM or USB partition when connected for the first time to provide drivers and utilities to the host. Because this internal storage is classified as a removable drive by the operating system, it triggers the Removable Media Files protection module in your Restriction Profile, which blocks the driver's execution.

To resolve this issue, I'll share the recommended solution and the steps to implement it.

1. Identify the Blocked Executable
   • Navigate to the Incidents or Alerts tab in the Cortex XDR console.
   • Look for an alert titled "Execution from a Restricted Location" where the Component is listed as MEDIA_CTRL.
   • Note the exact file name (for example, PTLITE10.EXE or setup.exe) and, if possible, the SHA256 hash.
     

2. Configure the Legacy Agent Exception

   • Navigate to Settings > Endpoints > Exception Configuration.
   • Click + New Exception and select Legacy Agent Exception.
   • Provide a descriptive name (for example, Allow Printer Driver Installers).
   • Select the Windows platform.
   • In the Module dropdown, select Removable Media Files.
     
   • In the Target field, enter the file name using a leading wildcard to account for different drive letters (for example, D:* vs **E:*).

   Use the following syntax: *[FILE_NAME].exe

   Example: *setup.exe or *PTLITE10.EXE


3. Apply the Exception to the Policy
   • Go to Endpoints > Policy Management.
   • Edit the policy rule applied to your endpoints.
   • Add the newly created Exception Profile to the rule.
   • Save the policy and ensure it is deployed to the agents.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar